Fixed bug #63726 (Memleak with static properties and internal/user classes)

No test scripts provided (will try to find one)

diff --git a/NEWS b/NEWS
index 2023198d19af98cf7ef787dc63d90975c8699356..29b62a3955c478086210cc834e5820195085fb82 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,8 @@ PHP                                                                        NEWS
 ?? ??? 2012, PHP 5.4.10
 
 - Core:
+  . Fixed bug #63726 (Memleak with static properties and internal/user
+    classes). (Laruence)
   . Fixed bug #63635 (Segfault in gc_collect_cycles). (Dmitry)
   . Fixed bug #63512 (parse_ini_file() with INI_SCANNER_RAW removes quotes
     from value). (Pierrick)

diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index c3d62c2729b782314811b752d433f67b68eba3d8..6dadd4d06016de4f29c867db1f6562a99fffd1bd 100644 (file)
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -3708,6 +3708,8 @@ ZEND_API int zend_update_static_property(zend_class_entry *scope, const char *na
                                (*property)->value = value->value;
                                if (Z_REFCOUNT_P(value) > 0) {
                                        zval_copy_ctor(*property);
+                               } else {
+                                       efree(value);
                                }
                        } else {
                                zval *garbage = *property;

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index f25e7fac6d2d9ee746ec5cebe818662132dea7ba..917e0c1097b13e5e8c64c8c306f130c05e034358 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -3333,7 +3333,7 @@ static zend_bool do_inherit_property_access_check(HashTable *target_ht, zend_pro
                if ((child_info->flags & ZEND_ACC_PPP_MASK) > (parent_info->flags & ZEND_ACC_PPP_MASK)) {
                        zend_error(E_COMPILE_ERROR, "Access level to %s::$%s must be %s (as in class %s)%s", ce->name, hash_key->arKey, zend_visibility_string(parent_info->flags), parent_ce->name, (parent_info->flags&ZEND_ACC_PUBLIC) ? "" : " or weaker");
                } else if ((child_info->flags & ZEND_ACC_STATIC) == 0) {
-                       Z_DELREF_P(ce->default_properties_table[parent_info->offset]);
+                       zval_ptr_dtor(&(ce->default_properties_table[parent_info->offset]));
                        ce->default_properties_table[parent_info->offset] = ce->default_properties_table[child_info->offset];
                        ce->default_properties_table[child_info->offset] = NULL;
                        child_info->offset = parent_info->offset;

diff --git a/Zend/zend_object_handlers.c b/Zend/zend_object_handlers.c
index d82493aeafad35f74f184a61495bbd206df1b755..3374b0b3cf3a0e9658aac730c54665879f15f296 100644 (file)
--- a/Zend/zend_object_handlers.c
+++ b/Zend/zend_object_handlers.c
@@ -539,6 +539,8 @@ ZEND_API void zend_std_write_property(zval *object, zval *member, zval *value, c
                                (*variable_ptr)->value = value->value;
                                if (Z_REFCOUNT_P(value) > 0) {
                                        zval_copy_ctor(*variable_ptr);
+                               } else {
+                                       efree(value);
                                }
                                zval_dtor(&garbage);
                        } else {